Lucene search

@huntrdevCVE-2022-4136

HistoryNov 24, 2022 - 8:15 a.m.

CVE-2022-4136

2022-11-2408:15:09

CWE-749

@huntrdev

web.nvd.nist.gov

cve

2022

4136

rce

qmpass

leadshop

nvd

security vulnerability

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.002

Percentile

57.1%

JSON

Dangerous method exposed which can lead to RCE in qmpass/leadshop v1.4.15 allows an attacker to control the target host by calling any function in leadshop.php via the GET method.

Affected configurations

Nvd

Node

leadshopleadshopMatch1.4.15

VendorProductVersionCPE
leadshopleadshop1.4.15cpe:2.3:a:leadshop:leadshop:1.4.15:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
leadshop	leadshop	1.4.15	cpe:2.3:a:leadshop:leadshop:1.4.15:::::::*

CNA Affected

[
  {
    "vendor": "qmpaas",
    "product": "qmpaas/leadshop",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "1.4.16",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/qmpaas/leadshop/commit/f27e9ca5c93eaadda1097396b65c234b16186d67

huntr.dev/bounties/fe418ae1-7c80-4d91-8a5a-923d60ba78c3

Social References

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.002

Percentile

57.1%

JSON

Related for CVE-2022-4136